Security Policy

Harmony MBS maintains security controls appropriate for a public-facing healthcare website. Controls should include, where operationally appropriate:

• HTTPS enforced across all public pages
• TLS certificates maintained and renewed
• Security headers configured where supported
• Routine operating system and WordPress updates
• Timely plugin and theme patching
• Malware scanning
• Firewall protection
• Security logging
• Encrypted backups
• Recovery testing
• Multi-factor authentication for administrator accounts
• Role-based permissions following the principle of least privilege
• Removal of unused plugins, themes, and user accounts
• Regular review of administrator access

The public Website should be configured to reduce unnecessary attack surface.

Recommended controls include:

• Disable file editing within WordPress administration
• Restrict administrative login attempts
• Implement brute-force protection
• Remove unused software components
• Disable unnecessary services
• Protect configuration files
• Restrict directory browsing
• Maintain secure file permissions
• Perform scheduled vulnerability assessments

Harmony MBS maintains strict separation between the public Website and clinical systems.

Accordingly:

• No Protected Health Information shall be stored within WordPress.
• No patient records shall be maintained within Website infrastructure.
• Website analytics shall remain operationally separate from clinical systems.
• Scheduling, intake, telehealth, messaging, and payments shall occur exclusively through secure HIPAA-compliant systems.
• No shared identifiers shall be used to associate Website analytics with individual patient records.

Email systems should implement industry-standard authentication controls, including:

• SPF (Sender Policy Framework)
• DKIM (DomainKeys Identified Mail)
• DMARC (Domain-based Message Authentication, Reporting, and Conformance)

Administrative email accounts should utilize strong authentication and be monitored for suspicious activity.

Public communication channels should employ reasonable protections against automated abuse, including where appropriate:

• CAPTCHA or equivalent human-verification technologies
• Honeypot fields
• Rate limiting
• Spam filtering
• Email validation
• IP reputation controls
• Automated bot detection
• Logging of repeated abuse attempts

Harmony MBS reserves the right to block, filter, throttle, or otherwise restrict communications reasonably believed to violate this Policy.

Harmony MBS periodically reviews Website security controls to help identify:

• unauthorized access attempts;
• malware activity;
• automated attacks;
• unusual administrative activity;
• abnormal traffic patterns;
• security misconfigurations; and
• other indicators of compromise.

Appropriate corrective action may include updating configurations, restricting access, removing malicious content, or engaging qualified security professionals.